CCSP Practice Test 27 — 15 Questions

Question 1

A company uses a cloud key management service with automatic annual key rotation. An auditor requires that keys are rotated every 90 days to meet internal policy. What should the cloud security architect do to satisfy this requirement?

Accepted Answer

Configure the cloud KMS with a custom rotation period of 90 days.. Option C is correct because cloud KMS services (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS) allow administrators to define a custom rotation period, overriding the default annual rotation. By configuring a 90-day rotation schedule, the architect directly meets the auditor's policy without manual intervention or exceptions, ensuring automated compliance.

Answer

Create a manual process to rotate keys every 90 days using scripts.

Answer

Request an exception from the auditor because the default annual rotation is sufficient.

Answer

Disable automatic rotation and rotate keys manually when needed.

Question 2

An organization uses a continuous integration/continuous deployment (CI/CD) pipeline to deploy infrastructure as code. The security team wants to ensure that all cloud resources comply with internal security policies before deployment. Which of the following is the MOST effective method to enforce this?

Accepted Answer

Run automated policy compliance checks as part of the CI/CD pipeline.. Option D is correct because integrating policy-as-code scanning into the CI/CD pipeline catches non-compliance before deployment. Option A is incorrect because manual reviews are error-prone and slow. Option B is incorrect because post-deployment scanning is reactive. Option C is incorrect because only limiting user permissions does not prevent misconfigurations from valid users.

Answer

Restrict the IAM permissions of developers to only approved roles.

Answer

Conduct manual security reviews after each deployment.

Answer

Deploy resources and then scan for compliance after deployment.

Question 3

A cloud security administrator is reviewing the security controls for a SaaS application. Which of the following are typically the responsibility of the cloud customer (tenant) in a SaaS model? (Choose two.)

Accepted Answer

Managing user access and identity. In a SaaS model, the customer is responsible for managing user access and identity (B) and data classification and encryption at rest (D). The provider handles patching the underlying OS (A), physical security (C), and network infrastructure security (E).

Answer

Physical security of data center

Answer

Network infrastructure security

Answer

Patching the underlying operating system

Question 4

An organization uses a cloud key management service (KMS) to encrypt data at rest. The security policy requires that the encryption keys be rotated every 90 days. The operations team is concerned about the impact of key rotation on encrypted data. Which of the following statements is true regarding KMS key rotation?

Accepted Answer

Data encrypted before rotation can still be decrypted using the previous key as long as it is available. Option B is correct because cloud KMS retains previous key versions after rotation, allowing decryption of data encrypted with older keys. The key rotation creates a new cryptographic key version, but the old version remains active for decryption until it is disabled or deleted. This ensures that data encrypted before rotation remains accessible without re-encryption.

Answer

Key rotation is not supported in cloud KMS

Answer

The KMS automatically re-encrypts all data with the new key

Answer

Existing data encrypted with the previous key must be re-encrypted with the new key

Question 5

A cloud security engineer is reviewing incident response procedures for a hybrid cloud environment. During a security incident, the team needs to collect forensic evidence from a compromised virtual machine while preserving its state. Which of the following actions should be taken first?

Accepted Answer

Disconnect the virtual machine from the network. Option A is correct because isolating the VM (disconnecting it from the network) prevents further damage or data exfiltration, and then a snapshot can be taken. Option B (snapshot) comes after isolation. Option C (install agent) may alter the evidence. Option D (notify provider) is done in parallel but not first.

Answer

Take a snapshot of the virtual machine's disk

Answer

Notify the cloud provider

Answer

Install a forensic agent on the virtual machine

Question 6

During a security incident in a multi-tenant cloud environment, the cloud provider's logging system indicates that a virtual machine (VM) on a shared hypervisor has been compromised. The provider wants to assist the customer with forensic analysis while minimizing impact to other tenants. Which approach is most appropriate?

Accepted Answer

Provide the customer with a memory snapshot of the compromised VM.. Option B is correct because providing a memory snapshot of the compromised VM preserves volatile forensic data (e.g., running processes, network connections, encryption keys) without disrupting the hypervisor or other tenants. This approach adheres to the cloud provider's responsibility to isolate forensic evidence while maintaining multi-tenant isolation, as memory snapshots can be taken via hypervisor-level APIs (e.g., VMware VMotion or libvirt) without powering off the VM or cloning the entire host.

Answer

Rebuild the VM from a known good image and then run security scans.

Answer

Clone the entire hypervisor and give the customer access to the clone.

Answer

Power off the VM immediately to contain the incident.

Question 7

Which TWO of the following are best practices for implementing baseline configuration management in a cloud environment? (Choose two.)

Accepted Answer

Automate the deployment of baseline configurations using orchestration tools. Automating the deployment of baseline configurations using orchestration tools (e.g., AWS CloudFormation, Terraform, or Ansible) ensures consistency, reduces human error, and enforces security controls across cloud resources. This aligns with the principle of immutable infrastructure, where configurations are deployed programmatically rather than manually adjusted.

Answer

Allow administrators to manually adjust configurations as needed to maintain flexibility

Answer

Disable configuration drift detection to reduce alert fatigue

Answer

Grant all users read/write access to configuration repositories for efficiency

Question 8

A company uses an Infrastructure as a Service (IaaS) provider for critical applications. They need to define a backup retention policy that meets regulatory requirements for keeping financial records for 7 years. Which of the following strategies best meets this requirement while optimizing costs?

Accepted Answer

Perform daily backups, keep weekly backups for 3 months, monthly for 1 year, and yearly for 7 years in cold storage.. Option B is correct because it implements a tiered backup retention strategy that aligns with the 7-year regulatory requirement while minimizing storage costs. By transitioning weekly backups to cold storage after 3 months, monthly backups after 1 year, and yearly backups for the full 7 years, the company reduces the cost of storing infrequently accessed data. This approach leverages the IaaS provider's lifecycle management policies (e.g., AWS S3 Lifecycle or Azure Blob Storage access tiers) to automatically move backups to lower-cost storage classes like Glacier or Archive, which are optimized for long-term retention.

Answer

Perform daily full backups and retain all backups for 7 years.

Answer

Replicate all backups to a secondary region with snapshots kept for 7 years.

Answer

Use a grandfather-father-son rotation scheme with weekly, monthly, and yearly backups.

Question 9

A company has implemented a centralized logging solution for its cloud environment. The security team notices that logs from a critical application are missing for the past hour. What is the MOST likely cause?

Accepted Answer

The logging agent on the application server stopped working. Option B is correct because the most common cause of missing logs is a misconfiguration in the logging agent or log forwarder. Option A is wrong because log retention policies affect how long logs are stored, not whether they are generated. Option C is wrong because encryption does not prevent log generation. Option D is wrong because user permission changes would not cause logs to stop being sent, they would affect access to existing logs.

Answer

The log retention policy was set to 0 days

Answer

Log encryption was enabled causing a delay

Answer

The security team does not have read permission on the log bucket

Question 10

Which THREE of the following are key components of an incident response plan specific to cloud environments? (Choose three.)

Accepted Answer

Establishing a process for preserving system snapshots and logs as evidence. Options B, D, and E are correct. B: Contacting the cloud provider is essential for assistance and evidence preservation. D: Understanding the shared responsibility model clarifies who does what. E: Documenting system baseline configurations helps identify changes. Option A is wrong because data forensic analysis is part of response but not a plan component; more specifically, the plan should include procedures, not just analysis. Option C is wrong because primarily the incident response team handles, but legal involvement is case-specific, not necessarily all incidents.

Answer

Requiring involvement of the legal department for every incident

Answer

Including a detailed data forensic analysis procedure for all incident types

Question 11

Refer to the exhibit. An administrator attaches security group sg-12345 to a web server. Which of the following describes the traffic that will be allowed by the security group?

Accepted Answer

Inbound HTTP and HTTPS from anywhere, and SSH only from the internal network are allowed.. Option D is correct. Inbound HTTP and HTTPS from anywhere (0.0.0.0/0) are allowed. SSH is allowed only from the internal network (10.0.0.0/8). Outbound all traffic is allowed. Options A, B, and C are incorrect because they misrepresent the rules.

Answer

Only SSH traffic from the internal network is allowed inbound.

Answer

The server cannot initiate any outbound connections.

Answer

All inbound traffic from the internet is allowed.

Question 12

A cloud security engineer reviews the Terraform configuration above. Which of the following is a security best practice that has been violated?

Accepted Answer

The security group allows unrestricted inbound traffic on port 80. Option A is correct because the security group allows unrestricted inbound traffic on port 80 from any source (0.0.0.0/0), violating the principle of least privilege. Option B (public AMI) is not necessarily a violation. Option C (plain text user_data) is a minor concern but not a best practice violation per se; secrets should not be in user_data. Option D (no SSH access) is acceptable if not needed.

Answer

The user_data script should not be in plain text

Answer

The security group does not allow SSH access

Answer

The instance uses a public AMI

Question 13

An organization has implemented a change management process for its cloud infrastructure. During a routine change, a network security group rule is modified incorrectly, causing a critical application to become inaccessible. What is the most effective way to prevent this issue in future changes?

Accepted Answer

Integrate automated configuration validation tests into the change pipeline.. Option D is correct because automated testing validations catch misconfigurations before production deployment. Option A is wrong because requiring manager approval does not prevent technical errors. Option B is wrong because peer review helps but is manual and can miss issues. Option C is wrong because rollback plans are reactive, not preventive.

Answer

Require all changes to be approved by two managers.

Answer

Ensure every change has a rollback plan.

Answer

Implement a peer review process for all change requests.

Question 14

During a security incident involving a compromised virtual machine (VM) in a public cloud, the incident response team needs to preserve evidence for potential legal action. Which of the following actions should be taken FIRST?

Accepted Answer

Create a forensic image of the VM's volumes while it is still running. Option D is correct because creating a forensic image of the VM's volumes captures volatile and persistent data while preserving the original state. Option A is wrong because deleting the VM destroys evidence. Option B is wrong because stopping the VM may cause loss of volatile data but snapshotting after stop is acceptable, but the best first step is to create a forensic image before stopping. Option C is wrong because isolating the network is important but does not preserve the VM state for forensics as effectively as imaging.

Answer

Stop the VM and take a snapshot of its disks

Answer

Delete the VM immediately to prevent further damage

Answer

Isolate the VM by removing it from the network

Question 15

Refer to the exhibit. A data sync job fails with the error shown. The IAM role 'data-sync-role' has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:*:*:data-bucket-2024/*"
    }
  ]
}

What is the MOST likely cause of the failure?

Accepted Answer

The resource ARN in the policy is incorrectly formatted, causing the action to not be applied.. Option C is correct. The resource ARN in the policy uses wildcards incorrectly: 'arn:aws:s3:*:*:data-bucket-2024/*' is not a valid S3 object ARN. The correct format is 'arn:aws:s3:::data-bucket-2024/*'. The malformed ARN means the policy does not actually grant access to the object. Option A is incorrect because the bucket exists. Option B is incorrect because the role is attached. Option D is incorrect because there is no explicit deny.

Answer

The role 'data-sync-role' is not attached to the sync job.

Answer

The bucket 'data-bucket-2024' does not exist.

Answer

There is an explicit Deny policy blocking the action.